FinlandLaki eräiden tekoälyjärjestelmien valvonnasta, Act on the Supervision of Certain Artificial Intelligence Systems
Laki eraiden tekoalyjarjestelmien valvonnasta (1377/2025)
In force since .
An AI governance rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Place of effect
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- If you are a provider or a representative established in Finland, keep the documents referred to in Article 18(1) of the AI Act available to the market surveillance authorities and the notifying authorities for ten years after a high-risk AI system is placed on the market or put into service, even through liquidation, bankruptcy, or the business ceasing or being transferred (Section 26).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Penalty structure
Section 23 sets the ceiling at three tiers depending on which duty was violated. The highest tier, recorded here, is EUR 35,000,000 or 7 percent of an undertaking's total worldwide annual turnover for the preceding financial year, whichever is higher, for a fine under Section 21 for violating the AI Act's prohibited-practices rules. A middle tier of EUR 15,000,000 or 3 percent of turnover applies to a fine under Sections 14 to 19 (duties of a provider, authorized representative, importer, distributor, deployer or notified body) or Section 22 (transparency-obligation violations). A lower tier of EUR 7,500,000 or 1 percent of turnover applies to a fine under Section 20 for supplying incorrect, incomplete or misleading information. A micro, small or medium-sized enterprise's ceiling under any tier is instead the lower, not the higher, of the stated percentage or fixed amount.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 35,000,000
- Turnover percentage cap
- 7
Who enforces it
Enforcement body
Traficom, the common contact point under AI Act Article 70, together with the sectoral market-surveillance authorities for high-risk systems in their own regulated domains, and a Sanctions Board that decides administrative fines.
Settledness
Traficom's guidance published on concerns the transparency obligations of the AI Act, not the retention duty in Section 26.
- As of
- Open questions
- Which market surveillance authority has issued, or will issue, the regulations on principles and procedures for keeping the documents referred to in Article 18.1 that the second paragraph of Section 26 allows, and do they change how a provider must keep those documents available for ten years?
- Does 'ett ombud som är etablerat i Finland' (a representative established in Finland) in the first paragraph of Section 26 bind only a representative whose seat is in Finland, leaving a provider that has appointed a representative in another member state, or none, to Article 18 of the AI Act alone?
What it makes you log
Who may demand the log
Regulator, Auditor or notified body
Log retention
This is a Finland-established provider's or representative's own duty under Section 26 to keep the AI Act Article 18(1) technical documentation available to Finland's market surveillance and notifying authorities for ten years. Article 18(1) is the AI Act's own documentation duty; this Act states the ten-year figure again in its own words as the Finland-facing availability duty on a Finland-established provider or representative.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
Section 20 lets the Sanctions Board fine an operator that intentionally or negligently gives incorrect, incomplete or misleading information in response to a request from a notified body or a market surveillance authority, which requires the operator to be able to give accurate information on demand. Section 26 separately requires a provider or a representative established in Finland to ensure the AI Act Article 18(1) technical documentation for a high-risk AI system stays available to the market surveillance and notifying authorities for ten years. Neither section itself names logs or records; both require producing or keeping something available on demand or over time, which makes each duty implicit rather than explicit.
- Kind
- Implicit
- As of
- Provision
- 12 §, 20 § and 26 §
- Trigger
- all_systems
- high_risk_systems
What this law does
The Act's administrative-fine mechanism, its main operative duty, reaches a provider, authorized representative, importer, distributor, or deployer of an AI system rather than a government body: Section 24 bars a fine against every named category of Finnish public authority. The Act supplements the EU AI Act within its Article 2 scope, but does not apply to the work of Parliament, the Parliamentary Ombudsman, or the Chancellor of Justice.
Section 6 designates Traficom (Transport- och kommunikationsverket) as the common contact point under AI Act Article 70, responsible for coordinating the authorities competent under this Act and, together with the other market surveillance authorities, for the annual reporting to the European Commission under AI Act Article 99(11). Sections 3, 4, and 5 split market surveillance of high-risk AI systems, prohibited practices, and transparency obligations among named sectoral authorities.
Section 13 creates a Sanctions Board (Påföljdsavgiftsnämnden) that decides an administrative fine under Sections 14 to 22 against a provider, authorized representative, importer, distributor, deployer, or notified body for breaching a duty under the AI Act.
Section 24 bars a fine against state authorities, state enterprises, municipal authorities, welfare regions, independent public-law institutions, parliamentary agencies, the Office of the President of the Republic, and the Evangelical Lutheran and Orthodox Churches in Finland and their parishes, against anyone already facing prosecution or a final conviction for the same act, and more than five years after the violation.
Government proposal HE 220/2026 vp would amend Section 3(1)(4) of the Act, on the occupational safety authority acting as a market surveillance authority for certain high-risk AI systems, to replace its references to the existing occupational safety supervision act and technical devices act with a reference to the proposed Act on the conformity of technical devices intended for use at work. The proposal describes the change to Section 3(1)(4) as technical. The proposed laws are intended to take effect on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, deploys a chatbot, generates content with AI or processes biometric data.
Back to the example · Lint your app
Page updated .